Dingtian input push: HTTP Digest auth + auto-config on assign

Secure the device→backend input push, and configure it automatically when the
admin assigns the device (no manual URL/secret entry).

Auth — HTTP Digest (chosen by hardware testing: the device can't push to a
self-signed HTTPS backend, but does Digest correctly; a URL token is sniffable/
logged):
- digest-auth.ts: MD5 qop=auth challenge/verify, single-use nonces (replay
  resistance). Password never crosses the wire.
- push route: Digest + source-IP allowlist; per-device pushUser/pushPassword from
  lane_devices. Still not behind the SPA cookie/CSRF auth (machine call). The
  signed event log remains the real anti-fraud guarantee.

Auto-config on assign:
- setup assign: for push-capable devices, generate Digest creds, call
  configureInputPush to write them + the push URLs to the device, store the creds
  (password not echoed back). net.ts derives the backend IP on the device's
  subnet (BACKEND_HOST_IP override).
- driver configureInputPush sets auth=2 + creds; PushConfig carries the creds.
- removed the earlier URL-token approach.

Two hard-won device-write bugs fixed in the driver:
- configApi now sets an explicit Content-Length — the device silently ignores
  chunked request bodies (Node's default without Content-Length), so every config
  write looked successful ({"status":0}) but did nothing. This was the root cause
  of the session's "writes don't apply" mystery.
- #writeConfig polls until the change is verified, retrying (the device reboots on
  apply; back-to-back writes were lost). The `pass` field caps at 31 chars, so the
  generated password is 24 hex chars.

Verified on hardware: assign auto-configures the device; all 4 inputs then push
with Digest auth, zero failures. wiki/device-input-flow updated.

wiki/log.md

@@ -145,3 +145,20 @@ model recorded in [[device-input-flow]]: flat network / no VLAN → backend is s
 of truth, every open is a signed event (out-of-band open = anomaly); push endpoint
 not behind cookie auth (machine call), shared-secret available as defence-in-depth.
 Next: wire signed event + ticket print + pulseOpen.
+
+## [2026-06-15] feature | Dingtian push auth via HTTP Digest (hardware-tested)
+Secured the device→backend input push. Empirically tested auth options on the
+device: HTTPS-to-self-signed FAILS, Basic works, **Digest works** → chose Digest
+(MD5, qop=auth): password never on the wire, single-use nonces. Backend
+digest-auth.ts (challenge/verify) + source-IP allowlist on the push route;
+per-device pushUser/pushPassword generated on assign, written to the device and
+stored in lane_devices (admin never types a URL/secret). Driver
+configureInputPush now sets auth=2 + creds; the assign flow auto-configures the
+device and persists the creds (net.ts derives the backend IP on the device's
+subnet). Removed the earlier URL-token approach (token in URL is sniffable/logged).
+TWO HARD-WON DEVICE BUGS fixed: (1) config_set requires an explicit Content-Length
+— the device silently ignores chunked bodies (Node's default), which masqueraded
+as "writes don't apply" all session; (2) the `pass` field caps at 31 chars →
+use a 24-char password. Driver #writeConfig now polls-until-verified (device
+reboots on apply). VERIFIED on hardware: assign auto-configures the device, then
+all 4 inputs push with Digest auth, zero failures. Recorded in [[device-input-flow]].